Russian State Hackers Used Claude to Rebuild Malware After Security Detection

Anthropic says it disrupted a cyber-espionage campaign in which Russian state-sponsored hackers used Claude across nearly every phase of an operation, from reconnaissance and phishing to malware deployment and command-and-control monitoring.

The threat cluster, tracked as GTG-20006, targeted more than 20 organizations spanning government, defense, diplomacy, intelligence, research, and industry. Anthropic assesses the activity as consistent with reporting associated with Midnight Blizzard, the Russian group also known as APT29 and Cozy Bear. The attribution indicates an overlap in assessed activity rather than a definitive statement that the labels are interchangeable.

The campaign’s defining feature was not simply AI-assisted malware coding. GTG-20006 built automated workflows that could detect when security software identified a malicious artifact, modify that artifact, rebuild it, and deploy the new version through disposable infrastructure.

That feedback loop could sharply reduce the defensive value of static signatures.

Claude Operated Across the Intrusion Lifecycle

GTG stands for Generative Threat Group, Anthropic’s designation for clusters that make operational use of generative AI. In this case, Claude was reportedly integrated into a broad system of agents rather than used as an occasional programming assistant.

The agents supported malware development, target reconnaissance, infrastructure deployment, phishing, persistence, compromise monitoring, and C2 oversight. They also registered domains, prepared phishing infrastructure, delivered messages, and watched command-and-control channels for evidence that a victim had been compromised.

Other agents monitored malware already running inside on-premises environments. They evaluated whether implants remained stealthy and persistent, and whether security controls had begun detecting them.

When a detection occurred, the workflow could initiate another development cycle. The malware was altered and rebuilt to evade the existing detection, then uploaded to a disposable hosting server for renewed delivery.

This is the campaign’s most consequential technical element. Traditional signature-based detection can force an attacker to stop, investigate why a payload was caught, revise the code manually, test it, and establish new delivery infrastructure. Automation compresses those steps and allows the attacker to repeat them more frequently.

The system does not make detection useless. It makes detections based primarily on stable file properties less durable.

Anthropic did not publish a CVSS score or formal severity rating. Such ratings would also be an imperfect fit because the disclosure concerns an adversary operation, not a single software vulnerability. The activity should nevertheless be treated as high impact because it combined adaptive malware, surveillance, account takeover, credential theft, and large-scale identity-data exfiltration.

The Toolkit Spanned Windows, Mobile Devices, and Phishing Infrastructure

The broader GTG-20006 toolkit included two Windows implants, a mobile exploitation kit, a browser-password stealer, and a phishing platform capable of impersonating high-priority targets such as government organizations.

The group also maintained an administrative console for handling compromised accounts. Fake software-update prompts were used to deliver Windows credential stealers, while supporting utilities enabled remote access and interfered with victims’ security updates.

Once a rebuilt artifact appeared capable of bypassing detection, the attackers placed it on temporary hosting infrastructure. Victims were directed there through conventional phishing, ClickFix-style social engineering, and manipulated DNS records.

ClickFix attacks typically convince users to perform an ostensibly corrective action themselves. In this operation, the lure formed part of a delivery chain that selected malware according to the victim’s operating system.

The disclosed Windows payloads were:

• PowerChrome
• WUEngine
• Shadow C2
• MiniPlasma
• CloudSyncSvc

Android devices received GiftDrop, described as a renamed version of the GiftsExpress Android surveillance remote-access Trojan. The iOS payload was identified as DarkSword.

Exact versions of the malware, hashes, domains, IP addresses, and other indicators of compromise have not been disclosed. There are also no identified patches or vendor remediation releases tied specifically to the campaign.

CaptiveCrunch Turned Hotel Wi-Fi Into a Targeting System

The activity overlapped with CaptiveCrunch, a campaign documented by ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs in July and August 2026.

Anthropic says GTG-20006 compromised at least three hospitality vendors responsible for hotel guest Wi-Fi networks. After obtaining administrator credentials, the attackers changed DNS records so that traffic was directed toward services under their control.

Guests connecting through affected networks exposed traffic information, device identifiers, and IP addresses to the attackers’ servers. The malicious redirection then supported operating-system-specific payload delivery through ClickFix-style lures.

The hotel intrusions also produced intelligence for subsequent targeting. Information taken from hotel-management systems and guest devices helped the group identify people linked to Ukraine, including government officials and drone manufacturers.

This made hospitality infrastructure more than an infection point. It became a collection and selection mechanism through which the attackers could identify valuable travelers, profile their devices, and choose follow-on actions.

GTG-20006 also attempted to take control of victims’ WhatsApp accounts. Headless browsers linked targeted accounts as companion devices, exported Russian- and Ukrainian-language conversations in bulk, and suppressed read receipts to reduce the chance that victims would notice the activity.

Camera Feeds, National Identity Records, and Cloud Email Were Compromised

The campaign extended into physical surveillance. GTG-20006 exploited authorization weaknesses in application interfaces used by camera-streaming platforms, allowing it to enumerate users and collect access tokens.

Those tokens provided access to victims’ live camera feeds. The affected platform versions and underlying authorization flaws have not been identified, so no specific software remediation is currently available.

In another intrusion, the group used credentials for a VPN appliance belonging to a North African government technology authority. The attackers took over the organization’s central account server and extracted its complete credential database.

The stolen material included more than 300,000 national identity records. Commercial-registry information covering over 500,000 companies operating in the country was also exfiltrated.

A separate branch of the operation focused on cloud email. The attackers created a device-code phishing framework called Embassy Kit, which supported Microsoft 365 token theft against diplomatic and government personnel.

Device-code phishing can grant an attacker authenticated access without requiring the victim to disclose a password directly to a fake login page. Instead, the target is persuaded to authorize an attacker-controlled session through a legitimate authentication flow.

The resulting campaign accessed and exfiltrated mail records from at least eight organizations. Victims included a national prosecutor’s office, a military education institute, and a regional intergovernmental organization.

Defenders Need Signals That Survive Malware Recompilation

Organizations cannot address this operation with a single patch. No specific security update, public indicator set, or vendor mitigation package has been identified in the reporting on Anthropic’s disruption of GTG-20006.

Defenders should instead prioritize behaviors and infrastructure changes that remain observable when malware files are rebuilt:

• Correlate endpoint behavior rather than relying on hashes alone. Watch for unusual credential-store access, persistence creation, security-update interference, and unexpected outbound C2 connections.
• Audit DNS administration. Hospitality providers and other managed-network operators should investigate unauthorized record changes, unfamiliar name servers, and short-lived destinations used in captive portals.
• Protect privileged credentials. Administrator accounts for hotel Wi-Fi systems, VPN appliances, identity servers, and cloud tenants require phishing-resistant authentication and tightly controlled recovery paths.
• Monitor Microsoft 365 device-code authentication. Investigate unexpected device-code grants, unusual geographic access, new applications, and token use inconsistent with the user’s normal devices.
• Review WhatsApp companion devices. Unknown linked sessions, unexplained account activity, and signs of automated message access should trigger account revocation and credential review.
• Hunt for disposable infrastructure. Newly registered domains, rapidly changing hosting endpoints, and repeated delivery attempts involving slightly different binaries may expose the rebuild-and-redeploy cycle.
• Examine surveillance-platform authorization. Camera services should validate that access tokens are properly scoped and cannot be obtained through user enumeration or broken authorization controls.

The timing of the full GTG-20006 campaign has not been disclosed. Its overlap with CaptiveCrunch places part of the related activity in July and August 2026, but it is not known when every intrusion began or ended.

The central change is operational speed. An attacker that can automatically react to security detections may regenerate tooling faster than teams can create and distribute static signatures. Defenders therefore need detections anchored in identity abuse, execution behavior, infrastructure patterns, and anomalous access—not only the binary that happened to be deployed first.